A global e-learning platform delivers video-on-demand content and user profile APIs using Amazon CloudFront, an Application Load Balancer (ALB), and Amazon EC2 instances. Recently, the platform experienced a distributed denial of service (DDoS) attack targeting the application layer (Layer 7) with a flood of HTTP POST requests, which overwhelmed the backend EC2 instances. A solutions architect must design a secure architecture to mitigate future Layer 7 DDoS attacks and prevent unauthorized traffic from bypassing CloudFront to access the ALB directly.
Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)
- Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.Answer
- Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.Answer
- CEnable AWS Shield Standard on the Application Load Balancer and configure a rate-limiting rule.
- DConfigure stateless Network ACLs on the public subnets to block all traffic except for the specific IP addresses of the application users.
- EAssociate an AWS WAF Web ACL directly with the Amazon EC2 instances and configure an HTTP header validation rule.
Answer
Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule, and configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.
To mitigate Layer 7 HTTP floods, AWS WAF rate-based rules must be deployed on the CloudFront distribution. To prevent users from bypassing CloudFront and accessing the Application Load Balancer directly, the ALB's security group must restrict inbound traffic using the AWS-managed prefix list for CloudFront.
Step-by-Step Solution
Key Concept
Securing web applications at the edge using Amazon CloudFront IP range security groups and AWS WAF rate-limiting.
Estimated Time:2m 0s